CVE-2026-62010

Summary

The Avventure application (<= 1.1.12) contains an unauthenticated PHP Object Injection vulnerability (CWE-502), allowing attackers to inject malicious serialized PHP objects via unsanitized user input, leading to arbitrary code execution or data manipulation.

Exploitability

Exploitation is straightforward for remote attackers due to the lack of authentication and direct exposure over the network.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across all users.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Avventure version 1.1.13 or later, which contains a fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.